Introduction

The SignSecure API lets you programmatically create envelopes, add recipients, send for signing, track progress, and manage templates and credits.

Base URL

https://api.signpad.signsecure.in/api/v1

All endpoints are relative to this base URL. For local development, the server runs at http://localhost:3000/api/v1.

Authentication

Every request (except /health) requires an API key sent as a Bearer token in the Authorization header:

Authorization: Bearer signsecure_xxxxxxxx...

API keys are created from Settings > API Keys in the dashboard. The key is shown once on creation — store it securely.

Organization Context

API keys inherit the workspace context in which they were created:

• Personal workspace — the key operates on your personal account and uses your personal credits.
• Organization workspace — the key is bound to that organization. Envelopes created with this key belong to the organization, credits are deducted from the organization wallet, and envelope listings are scoped to the organization. Only organization owners and admins can create API keys for an organization.

The workspace context is permanent for each key. To switch contexts, create a new API key in the desired workspace.

Permissions

Keys can be scoped with granular permissions per resource:

Keys can also have an optional expiration date (1–365 days).

Rate Limits

Each API key is limited to 1,000 requests per hour. When the limit is exceeded, requests return 403.

Error Format

All errors return a consistent JSON envelope. Use code for programmatic handling and message for display. The details object carries structured context that helps you fix the problem — its shape depends on the error code.

{
  "code": "VALIDATION_ERROR",
  "message": "fileName: Required",
  "details": {
    "validation": {
      "fieldErrors": { "fileName": ["Required"] },
      "formErrors": [],
      "issues": [
        { "path": "fileName", "message": "Required", "code": "invalid_type" }
      ]
    }
  },
  "requestId": "req_abc123",
  "timestamp": "2026-03-11T10:30:00.000Z"
}

Error Codes

Authentication & Authorization

Validation & Input

Envelope & Signing

Database & Server

Validation Error Details

VALIDATION_ERROR is the most common error. The details.validation object gives you everything you need to show per-field error messages in your UI:

{
  "code": "VALIDATION_ERROR",
  "message": "fileName: Required",
  "details": {
    "validation": {
      "fieldErrors": {
        "fileName": ["Required"],
        "fileSize": ["Expected number, received string"]
      },
      "formErrors": [],
      "issues": [
        { "path": "fileName", "message": "Required", "code": "invalid_type" },
        { "path": "fileSize", "message": "Expected number, received string", "code": "invalid_type" }
      ]
    }
  },
  "requestId": "req_abc123",
  "timestamp": "2026-03-11T10:30:00.000Z"
}

• fieldErrors — keyed by field path (e.g., "recipients.0.email"), each value is an array of error messages for that field
• formErrors — array of errors not tied to a specific field (e.g., cross-field validation)
• issues — flat array with each Zod validation issue including the code (e.g., invalid_type, too_small, invalid_enum_value)

Available Resources